@openrig/cli 0.5.0 → 0.5.1

package/daemon/dist/domain/queue-repository.js

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
+import { loadHumanRegistry } from "./gateway/human-registry.js";
+import { resolveExternal } from "./gateway/external-admission.js";
 import { QueueTransitionLog } from "./queue-transition-log.js";
+import { WAKE_INTENT_PREFIX } from "./outbox-handler.js";
 import { wrapPaneEnvelope } from "../lib/pane-envelope.js";
+import { getSelfHostId } from "./hosts/fanout-contract.js";
+import { parseSessionName } from "./session-name.js";
 import { computeClosureRequiredAt, validateClosure, } from "./hot-potato-enforcer.js";
 import { isHumanSeatSession, validateHumanPark, validateHumanRoute } from "./human-route-enforcer.js";
 export const QUEUE_STATES = [
@@ -24,6 +29,59 @@ export const TERMINAL_QUEUE_STATES = ["done", "handed-off"];
 export function isTerminalState(state) {
     return TERMINAL_QUEUE_STATES.includes(state);
 }
+/** 0.5.1-53 — the ACTIVE (still-progressing) states. A blocker is "live" iff active; any other
+ *  state (done/handed-off/canceled/denied/failed) means the block will never lift. This is DISTINCT
+ *  from the archiver's TERMINAL_QUEUE_STATES (done/handed-off) — a narrower concept — so it is named
+ *  separately and derived from QUEUE_STATES (the `satisfies` guard fails if a state is removed). */
+export const ACTIVE_QUEUE_STATES = ["pending", "in-progress", "blocked"];
+export function isBlockerLive(state) {
+    return ACTIVE_QUEUE_STATES.includes(state);
+}
+/** 0.5.1-53 Atom 1a — typed non-qitem gate blocker prefixes. A park may be gated on a fold / auth /
+ *  external condition that is NOT a qitem and NOT a human seat; these prefixes make such a gate a
+ *  first-class, compact-visible, downstream-classifiable blocker (the ruling detail rides a transition). */
+export const TYPED_GATE_BLOCKER_PREFIXES = ["fold:", "auth:", "external:"];
+export function typedGateBlockerPrefix(value) {
+    return TYPED_GATE_BLOCKER_PREFIXES.find((p) => value.startsWith(p)) ?? null;
+}
+/** A well-formed typed gate blocker: a recognized prefix AND a non-empty gate body. */
+export function isTypedGateBlocker(value) {
+    if (typeof value !== "string")
+        return false;
+    const p = typedGateBlockerPrefix(value);
+    return p != null && value.slice(p.length).trim().length > 0;
+}
+/**
+ * 0.5.1-54 DR-1 (classifier fold, PM ruling qitem-20260811163927-74493d76) — classify a create-path
+ * nudge FAILURE so the surfaced count becomes ACTIONABLE (constraint iii). Two classes:
+ *   - "permanent-topology": the destination is not resolvable on THIS daemon (the nudge can never
+ *     succeed here — a local-registry lookup reporting "not found" for a seat that lives on another
+ *     daemon). Retrying is a guaranteed-permanent failure repeated on a schedule → NOT retryable;
+ *     these belong to the ADDRESSING family, not to retry machinery. (The live corpus: 9/10 strands.)
+ *   - "transient": a live, resolvable seat that refused THIS attempt (busy at an interactive prompt) or
+ *     the attempt timed out — the only class a future bounded re-attempt (DR-2, held n=1) would touch.
+ *   - "unknown": a failure whose text matches NEITHER known pattern. NOT silently defaulted to transient
+ *     (ship-block ruling qitem-20260811170941-5eadb968): defaulting would assert "a live seat refused
+ *     this attempt" for a string that only means "did not match the permanent pattern" — two different
+ *     claims. An unknown must read as unknown (the same rule the ACTIVITY hookless=unknown ruling names);
+ *     a default that collapses unknown into a known class is the exact sin, mirrored.
+ * Returns null when `lastNudgeResult` is not a recorded failure (`failed:%`).
+ *
+ * Each class is a POSITIVE match — there is no default class. DR-2 (retry) stays HELD at n=1; this is
+ * READ-side labeling only, making the strand's nature legible (addressing-fix vs retry vs triage-the-unknown).
+ */
+export function classifyNudgeFailure(lastNudgeResult) {
+    if (typeof lastNudgeResult !== "string" || !lastNudgeResult.startsWith("failed:"))
+        return null;
+    // permanent-topology: local-registry "not found" — the destination is not resolvable on THIS daemon.
+    if (/\bnot found\b/i.test(lastNudgeResult))
+        return "permanent-topology";
+    // transient: a live seat refused this attempt (busy at a prompt) or the attempt timed out.
+    if (/interactive prompt|\btimed?\s?out\b/i.test(lastNudgeResult))
+        return "transient";
+    // unknown: matched neither — do NOT collapse into transient. Honest label > convenient default.
+    return "unknown";
+}
 export const QUEUE_PRIORITIES = ["routine", "urgent", "critical"];
 export class QueueRepositoryError extends Error {
     code;
@@ -114,12 +172,101 @@ function detectQueueColumn(db, columnName) {
 // rowToItem backfills them empty). Shared by `list` and `findOverdue` (Slice 15)
 // so the compact projection cannot drift between the two.
 const COMPACT_QUEUE_COLUMNS = "qitem_id, ts_created, ts_updated, source_session, destination_session, state, priority, tier, tags, blocked_on, handed_off_to, handed_off_from, expires_at, closure_reason, closure_target, closure_required_at, claimed_at, last_nudge_attempt, last_nudge_result, last_heartbeat, resolution, target_repo";
+export function stampSelfHostSuffix(session) {
+    if (session === undefined)
+        return undefined;
+    const selfId = getSelfHostId();
+    if (!selfId)
+        return session;
+    if (session.split("@").length !== 2)
+        return session; // not a bare member@rig — untouched
+    return `${session}@${selfId}`;
+}
+/**
+ * 51-09 increment 4b — additive TEACHING for the unknown_destination_rig refusal
+ * (arch ruling c9964404, mechanism ii). 3-part destinations ALREADY refuse (BR-1:
+ * member@rig@host greedy-folds to rig "rig@host", misses, rejects) — the code is
+ * UNCHANGED (C1). When the rejected destination's greedy-parsed rig token CONTAINS
+ * '@', return ADDITIVE structured fields (FR-7 precedent) teaching the out-of-band
+ * path: the split echo + a hint naming `--host`. C4: a SELF-suffixed destination
+ * names the self case and is NEVER auto-stripped/routed home (self-strip is option
+ * (i), routed to arch). Returns undefined for 2-part / non-canonical tokens (the
+ * refusal is byte-unchanged there). One helper, all four refusal sites (C2). Reads
+ * the FR-8 parse contract; the parse family stays byte-identical (C3).
+ */
+export function destinationRigTeaching(session) {
+    const parsed = parseSessionName(session);
+    if (parsed.kind !== "canonical" || !parsed.rig.includes("@"))
+        return undefined;
+    const at = parsed.rig.lastIndexOf("@");
+    const rig = parsed.rig.slice(0, at);
+    const host = parsed.rig.slice(at + 1);
+    const bare = `${parsed.member}@${rig}`;
+    const selfId = getSelfHostId();
+    const selfHost = !!selfId && host === selfId;
+    return {
+        destinationSplit: { member: parsed.member, rig, host },
+        selfHost,
+        hint: selfHost
+            ? `the host suffix '@${host}' is THIS host — the host never rides in the session string; resend the destination as ${bare}`
+            : `host does not ride in the session string; use --host ${host} with destination ${bare}`,
+    };
+}
+/**
+ * M1 A4b — entity-level teaching for an UNREGISTERED <local>@external destination (the
+ * ENTITY half of proof-2; the DOMAIN half is the closed-set fall-through to
+ * unknown_destination_rig, A1/A2). A row addressed to a valid @external domain whose
+ * entity is not in the registry refuses LOUDLY with the structured teaching from the
+ * gateway resolver (how to register + "not an agent seat"). Loads the registry only for
+ * the (rare) @external refusal path. Undefined for non-@external / registered / scheme.
+ */
+export function externalAdmissionTeaching(session) {
+    const parsed = parseSessionName(session);
+    if (parsed.kind !== "external")
+        return undefined;
+    const reg = loadHumanRegistry();
+    const entities = reg.ok ? reg.entities.map((e) => ({ entityId: e.entityId, address: e.address })) : [];
+    const res = resolveExternal(parsed.local, entities);
+    if (res.kind !== "unregistered")
+        return undefined; // registered/scheme were admitted upstream
+    return { externalDomain: parsed.domain, unregisteredEntity: parsed.local, hint: res.error };
+}
+/** The refusal teaching for ANY rejected destination: the @external entity teaching
+ *  (A4b) OR the host-suffix teaching (4b). One helper, all four refusal sites. */
+export function destinationRefusalTeaching(session) {
+    return externalAdmissionTeaching(session) ?? destinationRigTeaching(session);
+}
+/**
+ * MF6: does a transport error/reason string denote a TIMEOUT (ambiguous — the
+ * send may have landed) rather than a definite failure? Used to classify a wake
+ * delivery as `indeterminate` vs `failed`.
+ */
+function isWakeTimeoutSignal(s) {
+    return !!s && /timeout|timed\s*out|etimedout/i.test(s);
+}
 export class QueueRepository {
     db;
     transitionLog;
     eventBus;
     validateRig;
     transport;
+    /** W1 (transactional closure): the durable wake-intent store. A terminal act
+     *  (handoff / handoff-and-complete) stages an outbox intent row INSIDE its
+     *  db.transaction so close + transition + intent commit as one act or none;
+     *  the delivery drains from that committed intent afterward. Wired post-
+     *  construction by startup (dep-graph ordering, like transport).
+     *
+     *  ABSENT = the test/bootstrap path, and what that means differs by caller —
+     *  it is NOT a blanket best-effort fallback:
+     *   • a nudge-intended TERMINAL close+successor act FAILS CLOSED (MF2):
+     *     {@link assertTerminalClosureHasIntent} throws `wake_intent_store_unavailable`
+     *     rather than produce an executed-but-unwoken item (pass `nudge:false` for a
+     *     wake-less close);
+     *   • {@link deliverWakeForSuccessor} — and only it — falls back to the pre-W1
+     *     best-effort {@link maybeNudge} when no store is attached (P34 made that
+     *     fallback real code rather than a promise in a comment). */
+    outbox;
+    resolveOccupantGeneration;
     /** PL-007 Workspace Primitive — true when migration 038 has applied the
      *  queue_items.target_repo column. Older test fixtures that bypass the
      *  canonical migration list don't have the column; INSERTs degrade to
@@ -128,6 +275,8 @@ export class QueueRepository {
     hasTargetRepoColumn;
     hasSummaryColumn;
     hasEvidenceRefColumn;
+    hasMintingGenColumn;
+    hasClaimedGenColumn;
     /** OPR.0.4.6.WF3 FR-6 — injected by startup (never imported): the
      *  workflow domain's is-live-frontier-packet predicate. */
     workflowFrontierPredicate;
@@ -138,9 +287,14 @@ export class QueueRepository {
         this.validateRig = opts?.validateRig ?? (() => true);
         this.transport = opts?.transport;
         this.workflowFrontierPredicate = opts?.workflowFrontierPredicate;
+        this.resolveOccupantGeneration = opts?.resolveOccupantGeneration;
         this.hasTargetRepoColumn = detectQueueColumn(db, "target_repo");
         this.hasSummaryColumn = detectQueueColumn(db, "summary");
         this.hasEvidenceRefColumn = detectQueueColumn(db, "evidence_ref");
+        // GHOST-STAGE (e/Class-B): generation stamps (migration 063). Defensive detect so a pre-063
+        // harness degrades (writers skip the columns; the release predicate never matches unstamped rows).
+        this.hasMintingGenColumn = detectQueueColumn(db, "minting_generation_uuid");
+        this.hasClaimedGenColumn = detectQueueColumn(db, "claimed_by_generation_uuid");
         // OPR.0.3.2.20 — register the EXACT human-seat regex predicate as
         // a SQLite function so the attention query can apply the strict
         // check BEFORE LIMIT. LIKE / GLOB patterns are supersets that
@@ -164,6 +318,241 @@ export class QueueRepository {
     attachTransport(transport) {
         this.transport = transport;
     }
+    /**
+     * W1 (transactional closure): attach the durable wake-intent store AFTER
+     * construction (same dep-graph reason as {@link attachTransport}). Once
+     * attached, handoff / handoff-and-complete stage an outbox intent row inside
+     * their terminal transaction, so the close and its wake intent are one commit.
+     */
+    attachOutbox(outbox) {
+        // MF2: the wake intent must commit INSIDE the terminal transaction, which is
+        // only true when the outbox writes on the SAME connection. An outbox backed by
+        // a different DB would let the intent survive a rolled-back close (or vice
+        // versa) — "neither one act nor none". Reject a split-DB outbox at wire time.
+        if (outbox.db !== this.db) {
+            throw new QueueRepositoryError("outbox_db_mismatch", "attachOutbox requires an OutboxHandler bound to the SAME database connection as the queue repository — a split DB breaks the atomic close+intent seam");
+        }
+        this.outbox = outbox;
+    }
+    /**
+     * W1 (transactional closure) — the PUBLIC composable primitive (stage half).
+     * Stage the durable WAKE INTENT for a successor qitem from INSIDE a terminal
+     * act's `db.transaction` (the queue's own connection), so the intent commits
+     * atomically with the close + transition. Public + composable so any
+     * close+successor writer — handoff / handoff-and-complete today, Mission Control
+     * / Workflow via the P34 follow-on — can call it within its own transaction (the
+     * `createWithinTransaction` precedent), making that wiring pure EXTENSION, not
+     * rework. Pair with {@link assertTerminalClosureHasIntent}, run as the LAST
+     * statement of the same transaction.
+     *
+     * The pane nudge itself is a post-commit side effect (reversed-never — a pane
+     * write inside the txn would make the transaction lie); what is durable is this
+     * intent row, which the delivery drains afterward. Freezes the emitting envelope
+     * (MF4); idempotent by a deterministic outbox id keyed on the successor.
+     * `nudge:false` intends no wake ⇒ no intent. A missing outbox is enforced by the
+     * guard (fail-closed, MF2), not silently skipped here.
+     */
+    stageWakeIntent(successorQitemId, fromSession, toSession, identityProvenance, nudge) {
+        // No wake intended (nudge:false) ⇒ no durable intent to make durable. The
+        // W1-c guard is nudge-aware for the same reason: absence of an intent is a
+        // defect only when a wake WAS intended.
+        if (nudge === false)
+            return;
+        if (!this.outbox)
+            return;
+        // MF4: FREEZE the emitting envelope at stage time. Resolve the source occupant
+        // generation and build the full pane envelope NOW, and store it verbatim as the
+        // intent body. Delivery (immediate or crash-recovery) replays this exact text,
+        // so a recovery after a tenure swap can never relabel the wake with the CURRENT
+        // occupant's generation — it carries the generation that actually emitted it.
+        const bareBody = `Queue handoff: ${successorQitemId} - check your queue.`;
+        const stampISO = new Date().toISOString();
+        const genUuid = this.resolveOccupantGeneration?.(fromSession) ?? undefined;
+        const frozenEnvelope = wrapPaneEnvelope(fromSession, toSession, bareBody, getSelfHostId(), { stampISO, genUuid });
+        this.outbox.record({
+            outboxId: `${WAKE_INTENT_PREFIX}${successorQitemId}`,
+            senderSession: fromSession,
+            destinationSession: toSession,
+            body: frozenEnvelope,
+            auditPointer: successorQitemId,
+            identityProvenance: identityProvenance ?? null,
+        });
+    }
+    /**
+     * W1-c (transactional closure): the runtime SEAM GUARD. Called as the LAST
+     * statement inside a terminal act's db.transaction, it makes an
+     * executed-but-unwoken close UNWRITABLE: if this transaction wrote a terminal
+     * close AND a wake was intended, a durable wake intent for the successor MUST
+     * exist in the same transaction. If it does not, throw — the whole act rolls
+     * back at the seam, not at review.
+     *
+     * Nudge-aware: nudge:false intends no wake, so no intent is required. MF2:
+     * fail-closed when a wake IS intended but no intent store is attached (the
+     * guarantee is then impossible). PUBLIC composable primitive (guard half): any
+     * close+successor writer runs this as the LAST statement of its own transaction
+     * — handoff / handoff-and-complete today, Mission Control / Workflow via P34.
+     */
+    assertTerminalClosureHasIntent(sourceQitemId, successorQitemId, nudge) {
+        if (nudge === false)
+            return; // no wake intended ⇒ no intent required
+        // MF2: fail CLOSED. A nudge-intended terminal act with no intent store cannot
+        // make its wake durable, so the guarantee is impossible — refuse the close
+        // rather than silently produce an executed-but-unwoken item (the exact class
+        // W1 makes unwritable). Production always attaches an outbox at startup.
+        if (!this.outbox) {
+            throw new QueueRepositoryError("wake_intent_store_unavailable", "a nudge-intended terminal act requires an attached wake-intent store to make its wake durable — none attached (pass nudge:false for a wake-less close, or attach an outbox)");
+        }
+        // Reads the txn-visible (uncommitted) state on this connection.
+        const src = this.getById(sourceQitemId);
+        if (!src || !isTerminalState(src.state))
+            return; // not a terminal close
+        const intent = this.outbox.getById(`${WAKE_INTENT_PREFIX}${successorQitemId}`);
+        if (!intent) {
+            throw new QueueRepositoryError("terminal_close_without_wake_intent", `terminal closure of ${sourceQitemId} committed without staging its wake intent for ${successorQitemId} — one act or none is violated`);
+        }
+    }
+    /**
+     * W1-b: deliver ONE committed wake intent. MF3: CLAIM (pending→sending) before
+     * the external send, then finalize (sending→outcome) after — so overlapping
+     * drains send the wake exactly ONCE (the effect, not just the state), and a
+     * second drain of an already-claimed/resolved intent skips. Returns what
+     * happened for the drain's tally.
+     *
+     *   verified          → delivered
+     *   ok, unverified    → indeterminate   (ambiguous; never silently delivered/failed)
+     *   timeout (MF6)     → indeterminate   (may have landed — not a hard failure)
+     *   other not-ok/throw→ failed          (visible terminal state)
+     */
+    async deliverWakeIntent(outboxId) {
+        if (!this.outbox)
+            return "skipped";
+        if (!this.transport)
+            return "skipped"; // no transport → stays pending for a later drain
+        // MF3: CLAIM (pending→sending) BEFORE the external send so overlapping drains
+        // cannot both send. A losing claim — the row is no longer `pending` (already
+        // resolved, in-flight under another drainer, or claimed) — simply skips: no
+        // send, no tally. This makes the external effect once, not merely the state.
+        if (!this.outbox.claimForDelivery(outboxId))
+            return "skipped";
+        const intent = this.outbox.getById(outboxId);
+        if (!intent)
+            return "skipped"; // unreachable post-claim; defensive
+        // Only deliver a wake for a qitem that actually exists. A wake intent whose
+        // target qitem is missing — a caller-recorded id under this prefix (the route
+        // no longer refuses those), or a successor already swept — is finalized
+        // `failed`, never sent as a real wake.
+        if (!intent.auditPointer || !this.getById(intent.auditPointer)) {
+            this.outbox.finalizeDelivery(outboxId, "failed");
+            return "failed";
+        }
+        const qitemId = intent.auditPointer ?? outboxId;
+        // MF4: send the FROZEN envelope stored on the intent verbatim (no re-resolution).
+        const outcome = await this.performWakeSend(qitemId, intent.destinationSession, intent.senderSession, undefined, intent.body);
+        this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
+        const finalState = outcome.classified === "verified" ? "delivered" : outcome.classified;
+        this.outbox.finalizeDelivery(outboxId, finalState);
+        return finalState;
+    }
+    /**
+     * W1-b: the post-commit delivery for a successor's wake, and the ONE shared
+     * staged-intent delivery path. When the durable intent store is present
+     * (production), deliver the just-committed intent — which CLAIMS and FINALIZES
+     * the row, so a later recovery sweep cannot send it a second time. When it is
+     * absent (test/bootstrap), fall back to the pre-W1 best-effort nudge so behavior
+     * is unchanged where there is no intent to make durable. Called AFTER the
+     * terminal transaction commits (reversed-never: a pane write must not join the
+     * db transaction).
+     *
+     * PUBLIC as of P34: every terminal-closing writer that stages an intent must
+     * deliver through THIS path rather than {@link maybeNudge}. `maybeNudge` sends
+     * WITHOUT claiming or finalizing, so a staged intent would remain `pending` and
+     * the startup recovery sweep would deliver the same wake AGAIN. One staged
+     * intent, one delivery, one finalized row.
+     *
+     * P34 correction: the no-outbox fallback above was documented here but never
+     * implemented — `deliverWakeIntent` simply returns "skipped" with no outbox
+     * attached, so the nudge vanished SILENTLY (a skip is not an error, so nothing
+     * surfaced it). The pre-W1 callers reached this path only after the MF2 guard
+     * had already proven an outbox was attached, which is why it never showed. P34
+     * routes writers here whose harnesses attach no outbox, so the fallback is now
+     * real code rather than a promise in a comment.
+     */
+    async deliverWakeForSuccessor(successorQitemId, destinationSession, nudge, sourceSession) {
+        if (nudge === false)
+            return;
+        // No durable intent store ⇒ there is no intent to claim/finalize. Fall back to
+        // the pre-W1 best-effort nudge so the wake still happens (the documented
+        // contract), rather than silently skipping it.
+        if (!this.outbox) {
+            await this.maybeNudge(successorQitemId, destinationSession, nudge, sourceSession);
+            return;
+        }
+        await this.deliverWakeIntent(`${WAKE_INTENT_PREFIX}${successorQitemId}`);
+    }
+    /**
+     * W1-b: the startup-recovery sweep. Delivers wake intents a crash left
+     * committed-but-undelivered (the terminal txn committed, the process died
+     * before the post-commit deliver). Pages in bounded batches and TERMINATES on
+     * a served short batch or on a no-progress round (a flapping transport marks
+     * rows failed = visible, so it still progresses) — never a silent cap, never a
+     * spin.
+     *
+     * MF6 (honest retry policy): the sweep retries ONLY `pending` rows — i.e. wake
+     * intents a crash left committed-but-undelivered. Terminal `failed` and
+     * `indeterminate` rows are NOT re-driven: a failed row would risk resurrecting
+     * a dead wake and an indeterminate one may already have landed (double-send).
+     * Both are left in a VISIBLE terminal state for out-of-band reconciliation. No
+     * periodic timer (out of scope, ruled); a bounded retry of failed rows is the
+     * NAMED residue, not a silent guarantee.
+     */
+    /**
+     * BLOCKING 1 (guard re-seal): the recovery-boundary reconciliation, called ONCE
+     * at startup (NOT inside the drain, which can be invoked concurrently). Moves any
+     * abandoned `sending` wake intents — a prior crashed process's claims — to
+     * `indeterminate`, WITHOUT re-sending: a claim left `sending` is ambiguous (the
+     * send may or may not have landed). Kept SEPARATE from drainPendingWakeIntents so
+     * an overlapping drain can never reconcile another drain's in-flight claim.
+     * Returns the count reconciled.
+     */
+    reconcileAbandonedWakeIntents() {
+        if (!this.outbox)
+            return 0;
+        return this.outbox.reconcileAbandonedSending(WAKE_INTENT_PREFIX);
+    }
+    async drainPendingWakeIntents() {
+        const tally = { delivered: 0, indeterminate: 0, failed: 0 };
+        if (!this.outbox || !this.transport)
+            return tally;
+        const BATCH = 200;
+        for (;;) {
+            const pending = this.outbox.listPending(WAKE_INTENT_PREFIX, BATCH);
+            if (pending.length === 0)
+                break;
+            let progressed = 0;
+            for (const intent of pending) {
+                const outcome = await this.deliverWakeIntent(intent.outboxId);
+                if (outcome === "delivered") {
+                    tally.delivered++;
+                    progressed++;
+                }
+                else if (outcome === "indeterminate") {
+                    tally.indeterminate++;
+                    progressed++;
+                }
+                else if (outcome === "failed") {
+                    tally.failed++;
+                    progressed++;
+                }
+            }
+            // Nothing left pending changed state this round (e.g. transport gone
+            // mid-sweep) — stop rather than spin; the next daemon start retries.
+            if (progressed === 0)
+                break;
+            if (pending.length < BATCH)
+                break; // served short batch ⇒ drained
+        }
+        return tally;
+    }
     /**
      * Issue a default nudge to the destination after a create / handoff /
      * handoff-and-complete commit. Records the result via recordNudgeAttempt.
@@ -178,20 +567,60 @@ export class QueueRepository {
      * is now wrapped with the same From/To/---/body/---/↩ Reply envelope
      * that `rig send` uses. `sourceSession` is the seat that triggered
      * the create/handoff so the recipient pane shows where the nudge
-     * came from + a reply hint. When undefined, the envelope falls back
-     * to the canonical "<unknown sender>" marker (matches wrapPaneEnvelope).
+     * came from + a reply hint. A queue nudge is the ONE non-refusable
+     * sender — it has no seat to send an error back to — so when
+     * `sourceSession` is undefined `wrapPaneEnvelope` applies its own
+     * `<unknown sender>` fallback internally (`pane-envelope.ts`). After
+     * A1 that is the SOLE definition of the marker in the tree (the CLI
+     * copies were deleted, refused at the seat boundary instead); this
+     * site holds no copy of its own.
      */
     async maybeNudge(qitemId, destinationSession, nudgeOpt, sourceSession, bodyOverride) {
         if (nudgeOpt === false)
             return;
         if (!this.transport)
             return;
-        // OPR.0.4.4.19 FR-7: bodyOverride lets the resolve verb carry the
-        // decision text to the parked owner; default stays the handoff nudge.
-        const bareBody = bodyOverride ?? `Queue handoff: ${qitemId} - check your queue.`;
-        const text = wrapPaneEnvelope(sourceSession, destinationSession, bareBody);
+        const outcome = await this.performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride);
+        this.recordNudgeAttempt(qitemId, outcome.nudgeResult);
+    }
+    /**
+     * W1 (transactional closure): the shared wake-send CORE. Builds the pane
+     * envelope, sends with verify, and CLASSIFIES the transport result into the W1
+     * delivery vocabulary (verified | indeterminate | failed). It touches NO
+     * persistence — callers decide what to record: {@link maybeNudge} records the
+     * nudge attempt; {@link deliverWakeIntent} additionally CAS-marks the durable
+     * intent row. Only ever called when `this.transport` is set (callers guard).
+     *
+     * The `indeterminate` classification is the ambiguous face: `res.ok && !res.verified`
+     * — the delivery LANDED on the wire but its render could not be confirmed
+     * (the "delivered-ack-pending" nudge literal). It is never promoted to
+     * delivered nor demoted to failed.
+     */
+    async performWakeSend(qitemId, destinationSession, sourceSession, bodyOverride, prebuiltText) {
+        const stampISO = new Date().toISOString();
+        let text;
+        if (prebuiltText !== undefined) {
+            // MF4: a durable wake intent carries its FROZEN envelope (generation resolved
+            // at STAGE time). Deliver it verbatim — never rebuild — so a crash-recovery
+            // after a tenure swap replays the emitting generation, not the current one.
+            text = prebuiltText;
+        }
+        else {
+            // OPR.0.4.4.19 FR-7: bodyOverride lets the resolve verb carry the
+            // decision text to the parked owner; default stays the handoff nudge.
+            const bareBody = bodyOverride ?? `Queue handoff: ${qitemId} - check your queue.`;
+            // GHOST-STAGE (h): the single HG-5 baseline change deferred from g — the handoff nudge now carries
+            // a Sent: stamp (so it renders byte-parically with a rig send) plus the SOURCE seat's occupant
+            // generation (g's already-wired render, resolved here; absent=UNKNOWN=omit, never forged). The
+            // stampISO also feeds the transport's delivered-latency flag so a nudge that waited on a busy /
+            // mid-handover successor shows ' · delivered +Ns' for free.
+            const genUuid = sourceSession
+                ? (this.resolveOccupantGeneration?.(sourceSession) ?? undefined)
+                : undefined;
+            text = wrapPaneEnvelope(sourceSession, destinationSession, bareBody, getSelfHostId(), { stampISO, genUuid });
+        }
         try {
-            const res = await this.transport.send(destinationSession, text, { verify: true });
+            const res = await this.transport.send(destinationSession, text, { verify: true, stampISO });
             // OPR.0.3.2.21.FR-4(c) — wording rename: the prior literal
             // "sent-unverified" read as a failure even in the common case
             // (delivery confirmed but the synchronous ack window expired,
@@ -199,19 +628,37 @@ export class QueueRepository {
             // "delivered-ack-pending" reads as healthy. The old "verified"
             // case is unchanged for backward-compat with any tooling that
             // already consumed the positive literal.
-            const result = res.ok
-                ? (res.verified ? "verified" : "delivered-ack-pending")
-                : `failed:${res.error ?? res.reason ?? "unknown"}`;
-            this.recordNudgeAttempt(qitemId, result);
+            if (res.ok) {
+                return res.verified
+                    ? { classified: "verified", nudgeResult: "verified" }
+                    : { classified: "indeterminate", nudgeResult: "delivered-ack-pending" };
+            }
+            // MF6: a TIMEOUT is ambiguous — the send may have landed but the ack window
+            // expired — so it records `indeterminate` (never silently delivered, never a
+            // hard `failed`). A definite non-timeout failure (unreachable, unknown
+            // session) stays `failed`.
+            const detail = res.error ?? res.reason ?? "unknown";
+            if (isWakeTimeoutSignal(res.reason) || isWakeTimeoutSignal(res.error)) {
+                return { classified: "indeterminate", nudgeResult: `indeterminate:${detail}` };
+            }
+            return { classified: "failed", nudgeResult: `failed:${detail}` };
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            this.recordNudgeAttempt(qitemId, `failed:${msg}`);
+            // A thrown timeout is equally ambiguous (see above).
+            if (isWakeTimeoutSignal(msg)) {
+                return { classified: "indeterminate", nudgeResult: `indeterminate:${msg}` };
+            }
+            return { classified: "failed", nudgeResult: `failed:${msg}` };
         }
     }
     async create(input) {
+        // 51-09 incr 4 — stamp the origin host onto the STORED sender identity once,
+        // before validation/insert/idempotency, so the row's source_session IS the
+        // triple (fail-open to 2-part when no self-id / not a bare member@rig).
+        input = { ...input, sourceSession: stampSelfHostSuffix(input.sourceSession) };
         if (!this.validateRig(input.destinationSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`);
+            throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`, destinationRefusalTeaching(input.destinationSession));
         }
         const txn = this.db.transaction(() => this.createInTransactionalContext(input));
         let id;
@@ -273,7 +720,7 @@ export class QueueRepository {
      */
     createWithinTransaction(input) {
         if (!this.validateRig(input.destinationSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`);
+            throw new QueueRepositoryError("unknown_destination_rig", `destination_session ${input.destinationSession} references an unknown rig`, destinationRefusalTeaching(input.destinationSession));
         }
         const result = this.createInTransactionalContext(input);
         return {
@@ -312,29 +759,33 @@ export class QueueRepository {
         const chain = input.chainOfRecord ? JSON.stringify(input.chainOfRecord) : null;
         const expiresAt = input.expiresAt ?? null;
         const targetRepo = input.targetRepo ?? null;
+        // 0.5.1-53 Atom 2b — supersession back-link (successor -> the row it replaced). Absent for a normal create.
+        const handedOffFrom = input.handedOffFrom ?? null;
         if (this.hasTargetRepoColumn) {
             this.db
                 .prepare(`INSERT INTO queue_items (
             qitem_id, ts_created, ts_updated, source_session, destination_session,
-            state, priority, tier, tags, expires_at, chain_of_record, body, target_repo
-          ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?)`)
-                .run(id, ts, ts, input.sourceSession, input.destinationSession, priority, tier, tags, expiresAt, chain, input.body, targetRepo);
+            state, priority, tier, tags, expires_at, chain_of_record, handed_off_from, body, target_repo
+          ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(id, ts, ts, input.sourceSession, input.destinationSession, priority, tier, tags, expiresAt, chain, handedOffFrom, input.body, targetRepo);
         }
         else {
             this.db
                 .prepare(`INSERT INTO queue_items (
             qitem_id, ts_created, ts_updated, source_session, destination_session,
-            state, priority, tier, tags, expires_at, chain_of_record, body
-          ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?)`)
-                .run(id, ts, ts, input.sourceSession, input.destinationSession, priority, tier, tags, expiresAt, chain, input.body);
+            state, priority, tier, tags, expires_at, chain_of_record, handed_off_from, body
+          ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?, ?)`)
+                .run(id, ts, ts, input.sourceSession, input.destinationSession, priority, tier, tags, expiresAt, chain, handedOffFrom, input.body);
         }
         this.persistSummary(id, input.summary ?? null);
         this.persistEvidenceRef(id, input.evidenceRef ?? null);
+        this.persistMintingGeneration(id, input.sourceSession);
         this.transitionLog.append({
             qitemId: id,
             state: "pending",
             actorSession: input.sourceSession,
             transitionNote: "created",
+            identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
         });
         const persistedEvent = this.eventBus.persistWithinTransaction({
             type: "queue.created",
@@ -361,7 +812,7 @@ export class QueueRepository {
             throw new QueueRepositoryError("qitem_already_terminal", `qitem ${input.qitemId} is already in terminal state ${source.state}`);
         }
         if (!this.validateRig(input.toSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `to_session ${input.toSession} references an unknown rig`);
+            throw new QueueRepositoryError("unknown_destination_rig", `to_session ${input.toSession} references an unknown rig`, destinationRefusalTeaching(input.toSession));
         }
         const newId = newQitemId();
         const ts = new Date().toISOString();
@@ -403,6 +854,7 @@ export class QueueRepository {
                 transitionNote: input.transitionNote ?? `handed off to ${input.toSession}`,
                 closureReason: "handed_off_to",
                 closureTarget: input.toSession,
+                identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
             if (this.hasTargetRepoColumn) {
                 this.db
@@ -422,12 +874,18 @@ export class QueueRepository {
             }
             this.persistSummary(newId, input.summary ?? null);
             this.persistEvidenceRef(newId, input.evidenceRef ?? null);
+            this.persistMintingGeneration(newId, input.fromSession);
             this.transitionLog.append({
                 qitemId: newId,
                 state: "pending",
                 actorSession: input.fromSession,
                 transitionNote: `handoff from ${source.qitemId}`,
+                identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
+            // W1-a: the durable wake intent joins the SAME transaction as the close +
+            // successor create. If this (or anything above) throws, the whole act rolls
+            // back — one act or none.
+            this.stageWakeIntent(newId, input.fromSession, input.toSession, input.identityProvenance ?? null, input.nudge);
             const handoffEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.handed_off",
                 qitemId: source.qitemId,
@@ -447,12 +905,18 @@ export class QueueRepository {
                 summary: input.summary ?? null,
             });
             events.push({ name: "queue.created", payload: createdEvent });
+            // W1-c: the seam guard — the LAST statement in the terminal txn. A close
+            // that intended a wake cannot commit without its durable intent; a throw
+            // here rolls the whole act back at the seam.
+            this.assertTerminalClosureHasIntent(source.qitemId, newId, input.nudge);
         });
         txn();
         for (const e of events) {
             this.eventBus.notifySubscribers(e.payload);
         }
-        await this.maybeNudge(newId, input.toSession, input.nudge, input.fromSession);
+        // W1-b: deliver the just-committed wake intent (marking it), or the pre-W1
+        // best-effort nudge when no intent store is attached. Post-commit only.
+        await this.deliverWakeForSuccessor(newId, input.toSession, input.nudge, input.fromSession);
         return {
             closed: this.getByIdOrThrow(source.qitemId),
             created: this.getByIdOrThrow(newId),
@@ -474,7 +938,7 @@ export class QueueRepository {
             throw new QueueRepositoryError("qitem_already_terminal", `qitem ${input.qitemId} is already in terminal state ${source.state}`);
         }
         if (!this.validateRig(input.toSession)) {
-            throw new QueueRepositoryError("unknown_destination_rig", `to_session ${input.toSession} references an unknown rig`);
+            throw new QueueRepositoryError("unknown_destination_rig", `to_session ${input.toSession} references an unknown rig`, destinationRefusalTeaching(input.toSession));
         }
         const newId = newQitemId();
         const ts = new Date().toISOString();
@@ -514,6 +978,7 @@ export class QueueRepository {
                 transitionNote: input.transitionNote ?? `handoff-and-complete to ${input.toSession}`,
                 closureReason: "handed_off_to",
                 closureTarget: input.toSession,
+                identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
             if (this.hasTargetRepoColumn) {
                 this.db
@@ -533,12 +998,16 @@ export class QueueRepository {
             }
             this.persistSummary(newId, input.summary ?? null);
             this.persistEvidenceRef(newId, input.evidenceRef ?? null);
+            this.persistMintingGeneration(newId, input.fromSession);
             this.transitionLog.append({
                 qitemId: newId,
                 state: "pending",
                 actorSession: input.fromSession,
                 transitionNote: `handoff-and-complete from ${source.qitemId}`,
             });
+            // W1-a: the durable wake intent joins the SAME transaction as the close +
+            // successor create — one act or none (symmetric with handoff()).
+            this.stageWakeIntent(newId, input.fromSession, input.toSession, input.identityProvenance ?? null, input.nudge);
             const handoffEvent = this.eventBus.persistWithinTransaction({
                 type: "queue.handed_off",
                 qitemId: source.qitemId,
@@ -558,12 +1027,18 @@ export class QueueRepository {
                 summary: input.summary ?? null,
             });
             events.push({ name: "queue.created", payload: createdEvent });
+            // W1-c: the seam guard — the LAST statement in the terminal txn. A close
+            // that intended a wake cannot commit without its durable intent; a throw
+            // here rolls the whole act back at the seam.
+            this.assertTerminalClosureHasIntent(source.qitemId, newId, input.nudge);
         });
         txn();
         for (const e of events) {
             this.eventBus.notifySubscribers(e.payload);
         }
-        await this.maybeNudge(newId, input.toSession, input.nudge, input.fromSession);
+        // W1-b: deliver the just-committed wake intent (marking it), or the pre-W1
+        // best-effort nudge when no intent store is attached. Post-commit only.
+        await this.deliverWakeForSuccessor(newId, input.toSession, input.nudge, input.fromSession);
         return {
             closed: this.getByIdOrThrow(source.qitemId),
             created: this.getByIdOrThrow(newId),
@@ -701,20 +1176,34 @@ export class QueueRepository {
         }
         const ts = new Date().toISOString();
         const closureRequiredAt = computeClosureRequiredAt(ts, qitem.tier);
+        // GHOST-STAGE (e/Class-B): stamp the CLAIMANT's occupant generation. THIS is the ghost
+        // discriminator — under a handover the successor reuses the seat name, so a name-scoped release
+        // would neutralize the successor's own claims; the retiring generation's claims are released by gen.
+        const claimedByGeneration = this.hasClaimedGenColumn
+            ? (this.resolveOccupantGeneration?.(input.destinationSession) ?? null)
+            : null;
         const txn = this.db.transaction(() => {
-            this.db
-                .prepare(`UPDATE queue_items
-             SET state = 'in-progress',
-                 ts_updated = ?,
-                 claimed_at = ?,
-                 closure_required_at = ?
-           WHERE qitem_id = ?`)
-                .run(ts, ts, closureRequiredAt, input.qitemId);
+            if (this.hasClaimedGenColumn) {
+                this.db
+                    .prepare(`UPDATE queue_items
+               SET state = 'in-progress', ts_updated = ?, claimed_at = ?, closure_required_at = ?,
+                   claimed_by_generation_uuid = ?
+             WHERE qitem_id = ?`)
+                    .run(ts, ts, closureRequiredAt, claimedByGeneration, input.qitemId);
+            }
+            else {
+                this.db
+                    .prepare(`UPDATE queue_items
+               SET state = 'in-progress', ts_updated = ?, claimed_at = ?, closure_required_at = ?
+             WHERE qitem_id = ?`)
+                    .run(ts, ts, closureRequiredAt, input.qitemId);
+            }
             this.transitionLog.append({
                 qitemId: input.qitemId,
                 state: "in-progress",
                 actorSession: input.destinationSession,
                 transitionNote: "claimed",
+                identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
             });
             return this.eventBus.persistWithinTransaction({
                 type: "queue.claimed",
@@ -729,7 +1218,7 @@ export class QueueRepository {
         this.eventBus.notifySubscribers(persistedEvent);
         return this.getByIdOrThrow(input.qitemId);
     }
-    unclaim(qitemId, destinationSession, reason) {
+    unclaim(qitemId, destinationSession, reason, identityProvenance) {
         const qitem = this.getById(qitemId);
         if (!qitem) {
             throw new QueueRepositoryError("qitem_not_found", `qitem ${qitemId} not found`);
@@ -739,12 +1228,15 @@ export class QueueRepository {
         }
         const ts = new Date().toISOString();
         const txn = this.db.transaction(() => {
+            // (e/Class-B): returning to pending releases the claim, so clear the claimant-generation stamp
+            // (the item is now unclaimed; a fresh claimant will re-stamp its own generation).
+            const clearGen = this.hasClaimedGenColumn ? ", claimed_by_generation_uuid = NULL" : "";
             this.db
                 .prepare(`UPDATE queue_items
              SET state = 'pending',
                  ts_updated = ?,
                  claimed_at = NULL,
-                 closure_required_at = NULL
+                 closure_required_at = NULL${clearGen}
            WHERE qitem_id = ?`)
                 .run(ts, qitemId);
             this.transitionLog.append({
@@ -752,6 +1244,7 @@ export class QueueRepository {
                 state: "pending",
                 actorSession: destinationSession,
                 transitionNote: `unclaimed: ${reason}`,
+                identityProvenance: identityProvenance ?? null, // P21 §4 era-stamp
             });
             return this.eventBus.persistWithinTransaction({
                 type: "queue.unclaimed",
@@ -858,6 +1351,71 @@ export class QueueRepository {
         // enforcement). Blocking on another qitem requires nothing new (BR-1).
         const effectiveBlockedOn = input.blockedOn ?? qitem.blockedOn;
         const isHumanPark = input.state === "blocked" && isHumanSeatSession(effectiveBlockedOn);
+        // OPR.0.5.1 slice-51-06 D2 — summary/evidence_ref are persist-able ONLY at a human-seat park
+        // (see the FR-6 note below). Silently ignoring them on any other transition is a data-loss trap
+        // (the operator believes the metadata was saved). HARD-REJECT before ANY UPDATE/log/event so the
+        // caller learns immediately and nothing is half-applied. null/undefined = absent (allowed);
+        // empty string = present (a deliberate value → rejected on a non-park transition).
+        if (!isHumanPark) {
+            const invalidFields = [];
+            if (input.summary != null)
+                invalidFields.push("summary");
+            if (input.evidenceRef != null)
+                invalidFields.push("evidenceRef");
+            if (invalidFields.length > 0) {
+                const flags = invalidFields.map((f) => (f === "summary" ? "--summary" : "--evidence-ref")).join(" / ");
+                throw new QueueRepositoryError("summary_evidence_not_persistable", `${invalidFields.join(" + ")} persist only on a human-seat park (state=blocked on a human seat); the '${input.state}' transition cannot store them. Remove ${flags}, or park the item (rig queue block --on <human-seat> --summary … --evidence-ref …).`, { invalidFields });
+            }
+        }
+        // SWEEP-a (shape f2576102) — closure/blocked-field COHERENCE, beside the reference
+        // reject above: an incoherent field must never silently persist (worse than a drop —
+        // the COALESCE below would write it). Admits-map, derived from LIVE schema use:
+        //   closure_reason/closure_target → state "done", OR the PARK-RECORD form
+        //     (state "blocked" with closureReason "blocked_on" — the workflow gate/park
+        //     writers' established shape, workflow-runtime.ts:587/1013);
+        //   blocked_on → state "blocked" only.
+        const isParkRecord = input.state === "blocked" && input.closureReason === "blocked_on";
+        // Third live form (found by the neighborhood suites): the transactional handoff
+        // closes its source as state "handed-off" with closureReason "handed_off_to".
+        const isHandoffClose = input.state === "handed-off" && input.closureReason === "handed_off_to";
+        // 0.5.1-53 Atom 2a — FOURTH admitted form: the supersession-cancel. A row corrected by
+        // cancel-and-replace records state=canceled + closureReason=superseded + closureTarget=<successor>,
+        // so superseded is distinguishable from abandoned (a plain cancel keeps closureReason=null).
+        const isSupersedeCancel = input.state === "canceled" && input.closureReason === "superseded";
+        if (input.state !== "done" && !isParkRecord && !isHandoffClose && !isSupersedeCancel && (input.closureReason != null || input.closureTarget != null)) {
+            throw new QueueRepositoryError("closure_fields_not_admitted", `closure_reason/closure_target persist only on state=done, the blocked park-record form, the handoff close, or the superseded cancel; the '${input.state}' transition cannot store them. Close the item (--state done --closure-reason …) or drop the flags.`, {});
+        }
+        // A supersession must name WHAT replaced this row — fail LOUD before any write (never a silent
+        // no-op leaving a stale row, the dead-signal class), symmetric with handed_off_to's target rule.
+        if (isSupersedeCancel && !input.closureTarget) {
+            throw new QueueRepositoryError("missing_closure_target", `closure_reason=superseded requires closure_target (the successor qitem that replaced this row).`, {});
+        }
+        if (input.blockedOn != null && input.state !== "blocked") {
+            throw new QueueRepositoryError("blocked_on_not_admitted", `blocked_on persists only on state=blocked; the '${input.state}' transition cannot store it. Park the item (rig queue block --on …) or drop --blocked-on.`, {});
+        }
+        // 0.5.1-53 Atom 1b(ii) + 1a — blocker validation at the park moment. Non-human blocker kinds:
+        //   qitem-ref ("qitem-…")        → must EXIST and be LIVE (1b-ii); a ghost or dead blocker never lifts.
+        //   typed gate (fold:/auth:/…)   → first-class (1a), but a bare prefix with no gate body is malformed
+        //                                   (a typo must not masquerade as a gate).
+        //   anything else (legacy gate-name) → left as-is; out of this slice.
+        // Human-seat parks (isHumanPark) enforce their own FR-6 contract above.
+        if (input.state === "blocked" && !isHumanPark && typeof effectiveBlockedOn === "string") {
+            if (effectiveBlockedOn.startsWith("qitem-")) {
+                const blocker = this.getById(effectiveBlockedOn);
+                if (!blocker) {
+                    throw new QueueRepositoryError("blocker_not_found", `blocked_on names a qitem that does not exist: ${effectiveBlockedOn}. A park must name a real, live blocker — a nonexistent blocker can never complete, so the row could never unpark.`, { blockedOn: effectiveBlockedOn });
+                }
+                if (!isBlockerLive(blocker.state)) {
+                    throw new QueueRepositoryError("blocker_not_live", `blocked_on names a resolved qitem: ${effectiveBlockedOn} is '${blocker.state}'. A park must name a LIVE blocker — parking on a completed/closed row is a dead-blocker park that never self-clears.`, { blockedOn: effectiveBlockedOn, blockerState: blocker.state });
+                }
+            }
+            else {
+                const typedPrefix = typedGateBlockerPrefix(effectiveBlockedOn);
+                if (typedPrefix && !isTypedGateBlocker(effectiveBlockedOn)) {
+                    throw new QueueRepositoryError("blocker_malformed", `blocked_on '${effectiveBlockedOn}' is a bare '${typedPrefix}' prefix with no gate body. A typed gate blocker must name its gate (e.g. fold:one-home+attestation).`, { blockedOn: effectiveBlockedOn });
+                }
+            }
+        }
         let effectiveSummary = qitem.summary;
         let effectiveEvidenceRef = qitem.evidenceRef;
         if (isHumanPark) {
@@ -876,6 +1434,12 @@ export class QueueRepository {
         }
         const ts = new Date().toISOString();
         const fromState = qitem.state;
+        // 0.5.1-53 Atom 1b(i) — clear-on-exit. blocked_on is set EXPLICITLY, not COALESCE'd:
+        // a row keeps its blocker ONLY while `state=blocked` (effectiveBlockedOn = the new
+        // blocker, else the one it already carried), and any exit from blocked CLEARS it to
+        // NULL. The prior `COALESCE(?, blocked_on)` preserved the blocker on every non-blocked
+        // transition, leaving dead blockers that nothing audits (the root-cause strand).
+        const nextBlockedOn = input.state === "blocked" ? effectiveBlockedOn : null;
         this.db
             .prepare(`UPDATE queue_items
            SET state = ?,
@@ -883,9 +1447,9 @@ export class QueueRepository {
                closure_reason = COALESCE(?, closure_reason),
                closure_target = COALESCE(?, closure_target),
                handed_off_to = COALESCE(?, handed_off_to),
-               blocked_on = COALESCE(?, blocked_on)
+               blocked_on = ?
          WHERE qitem_id = ?`)
-            .run(input.state, ts, validation.closureReason, validation.closureTarget, input.handedOffTo ?? null, input.blockedOn ?? null, input.qitemId);
+            .run(input.state, ts, validation.closureReason, validation.closureTarget, input.handedOffTo ?? null, nextBlockedOn, input.qitemId);
         // FR-6: park-time summary/evidence_ref are PERSISTED onto the existing
         // item (not merely validated-then-dropped) — visible to the attention
         // query and to Packet 2. Only the park path writes them.
@@ -900,7 +1464,39 @@ export class QueueRepository {
             transitionNote: input.transitionNote,
             closureReason: validation.closureReason ?? undefined,
             closureTarget: validation.closureTarget ?? undefined,
+            identityProvenance: input.identityProvenance ?? null, // P21 §4 era-stamp
         });
+        // 0.5.1-53 Atom 1b(iii) — propagate-completion. blocked_on PROMISES "A waits until B completes";
+        // that promise never fired on this runtime (rows sat blocked on done/canceled blockers for days).
+        // When THIS qitem reaches a terminal state, auto-unpark every row parked on it (blocked_on = this,
+        // state='blocked') to pending, clear its (now-resolved) blocker, log the transition, and emit an
+        // event so watchers/sweeps see the unblock without a fetch.
+        if (!isBlockerLive(input.state)) {
+            const blockedRows = this.db
+                .prepare("SELECT qitem_id FROM queue_items WHERE blocked_on = ? AND state = 'blocked'")
+                .all(input.qitemId);
+            for (const r of blockedRows) {
+                this.db
+                    .prepare("UPDATE queue_items SET state = 'pending', blocked_on = NULL, ts_updated = ? WHERE qitem_id = ?")
+                    .run(ts, r.qitem_id);
+                this.transitionLog.append({
+                    qitemId: r.qitem_id,
+                    state: "pending",
+                    actorSession: input.actorSession,
+                    transitionNote: `auto-unparked: blocker ${input.qitemId} reached terminal state '${input.state}'`,
+                });
+                this.eventBus.persistWithinTransaction({
+                    type: "queue.updated",
+                    qitemId: r.qitem_id,
+                    fromState: "blocked",
+                    toState: "pending",
+                    closureReason: null,
+                    closureTarget: null,
+                    actorSession: input.actorSession,
+                    summary: null,
+                });
+            }
+        }
         return this.eventBus.persistWithinTransaction({
             type: "queue.updated",
             qitemId: input.qitemId,
@@ -1081,6 +1677,38 @@ export class QueueRepository {
         const rows = this.db.prepare(sql).all(...params);
         return rows.map((r) => this.rowToItem(r));
     }
+    /**
+     * 0.5.1-54 DR-1 — surface the create-path failed-nudge strands. `last_nudge_result` is written by
+     * `recordNudgeAttempt` (from `maybeNudge`) but nothing ever queries it, so a create whose nudge FAILED
+     * (`failed:<msg>`) is invisible: the sender records a successful create while the destination was never
+     * woken. This is the `/overdue` analogue for pending-undelivered create-path work — a READ only (no
+     * retry, no unwind; DR-2 retry is PM-gated on DR-1's live measurement).
+     *
+     * V1-ONLY predicate, NO false-positive mode: `state='pending' AND last_nudge_result LIKE 'failed:%'`.
+     *   - A delivered row (`verified` / `delivered-ack-pending`) is excluded — it was woken.
+     *   - A NEVER-ATTEMPTED row (`last_nudge_result IS NULL` — a deliberate cold-park or a no-transport create)
+     *     is excluded. That class is FP-dominated (a legitimate cold-park is indistinguishable from a real
+     *     never-reached strand at the row) and stays DEFERRED behind a forward create-time intent bit; surfacing
+     *     it here would train the reader to ignore the signal. The reason it is excluded lives in this comment
+     *     AND the PRD, not in chat — it must outlive the excluder.
+     */
+    findUndelivered(opts) {
+        const conditions = ["state = 'pending'", "last_nudge_result LIKE 'failed:%'"];
+        const params = [];
+        if (opts?.rig) {
+            const escaped = opts.rig.replace(/%/g, "\\%").replace(/_/g, "\\_");
+            conditions.push("(destination_session LIKE ? ESCAPE '\\' OR source_session LIKE ? ESCAPE '\\')");
+            params.push(`%@${escaped}`, `%@${escaped}`);
+        }
+        const columns = opts?.compact ? COMPACT_QUEUE_COLUMNS : "*";
+        let sql = `SELECT ${columns} FROM queue_items WHERE ${conditions.join(" AND ")} ORDER BY ts_created ASC`;
+        if (opts?.limit !== undefined) {
+            sql += " LIMIT ?";
+            params.push(opts.limit);
+        }
+        const rows = this.db.prepare(sql).all(...params);
+        return rows.map((r) => this.rowToItem(r));
+    }
     recordNudgeAttempt(qitemId, result) {
         const ts = new Date().toISOString();
         this.db
@@ -1158,6 +1786,53 @@ export class QueueRepository {
             this.db.prepare("UPDATE queue_items SET evidence_ref = ? WHERE qitem_id = ?").run(evidenceRef, qitemId);
         }
     }
+    /** GHOST-STAGE (e/Class-B) — persist the MINTING occupant-generation additively (same degrade
+     *  contract as persistSummary; NULL when unresolved/pre-063). Forensic provenance of the creator;
+     *  the RELEASE discriminator is claimed_by_generation_uuid (stamped at claim), not this. */
+    persistMintingGeneration(qitemId, sourceSession) {
+        if (!this.hasMintingGenColumn)
+            return;
+        const gen = this.resolveOccupantGeneration?.(sourceSession) ?? null;
+        if (gen === null)
+            return;
+        this.db.prepare("UPDATE queue_items SET minting_generation_uuid = ? WHERE qitem_id = ?").run(gen, qitemId);
+    }
+    /**
+     * GHOST-STAGE (e/Class-B) — at a seat swap, RELEASE (never hard-drop) every in-progress item CLAIMED
+     * by the RETIRING generation back to pending: the role work is durable and the successor re-claims it;
+     * only the retiree's stale claim is the ghost. Gen-scoped via claimed_by_generation_uuid (NOT the seat
+     * name — the successor shares it, so a name-scoped release would steal the successor's own claims). A
+     * NULL/empty generation never matches (UNKNOWN != retired). Clears the claim stamp + claimed_at and
+     * appends an audit transition per item. Returns the count released. Pre-063 dbs no-op.
+     */
+    releaseClaimsByGeneration(retiringGeneration) {
+        if (!this.hasClaimedGenColumn || !retiringGeneration)
+            return 0;
+        const rows = this.db
+            .prepare(`SELECT qitem_id FROM queue_items WHERE state = 'in-progress' AND claimed_by_generation_uuid = ?`)
+            .all(retiringGeneration);
+        if (rows.length === 0)
+            return 0;
+        const ts = new Date().toISOString();
+        const txn = this.db.transaction(() => {
+            for (const { qitem_id } of rows) {
+                this.db
+                    .prepare(`UPDATE queue_items
+               SET state = 'pending', ts_updated = ?, claimed_at = NULL, closure_required_at = NULL,
+                   claimed_by_generation_uuid = NULL
+             WHERE qitem_id = ?`)
+                    .run(ts, qitem_id);
+                this.transitionLog.append({
+                    qitemId: qitem_id,
+                    state: "pending",
+                    actorSession: "system",
+                    transitionNote: "released: claimant generation retired (seat handover)",
+                });
+            }
+        });
+        txn();
+        return rows.length;
+    }
     rowToItem(row) {
         return {
             qitemId: row.qitem_id,